# DNS Records

  
The following DNS record types are available in the [DNS Management](https://cp.openprovider.eu/dns/overview.php) of Openprovider; below the table, each DNS record is explained in more detail:

<table id="bkmrk-record-type-descript"><tbody><tr><td>Record type</td><td>Description</td><td>Value</td><td>Priority</td></tr><tr><td>[A](#a)</td><td>Refers to an IP address</td><td>Valid IPv4 address</td><td>-</td></tr><tr><td>[AAAA](#aaaa)</td><td>Refers to an IPv6 address</td><td>Valid IPv6 address</td><td>-</td></tr><tr><td>[CAA](#caa)</td><td>Defines which CAs are allowed to issue SSL certificates</td><td>Issuing information</td></tr><tr><td>[CNAME](#cname)</td><td>Alias for a subdomain</td><td>Valid hostname</td><td>-</td></tr><tr><td>[MX](#mx)</td><td>Defines a mailserver</td><td>Existing A-record</td><td>Low value means high priority</td></tr><tr><td>[NS](#ns)</td><td>Defines the nameservers</td><td>Valid nameservers</td><td>-</td></tr><tr><td>[SOA](#soa)</td><td>Important information about the DNS zone</td><td>This records contains information about:  
- the master nameserver  
- e-mailaddress of the zone responsible  
- some synchronization fields</td><td>-</td></tr><tr><td>[SPF](#spf) (deprecated)</td><td>Authorizes e-mail messages; see TXT record for details.</td><td>Sender Policy Framework definition</td><td>-</td></tr><tr><td>[SRV](#srv)</td><td>Allows for discovery of services</td><td>Weight, port and target</td><td>-</td></tr><tr><td>[TXT](#txt)</td><td>Allows human-readable text (max. 255 characters)</td><td>Free value; also used for definition of SPF, DKIM and DMARC records.

</td><td>-</td></tr><tr><td>[TLSA record](#bkmrk-tlsa-records)</td><td>Associates a domain with its TLS/SSL certificate for secure authentication</td><td>Usage, Selector, Matching type and Certificate association data

</td></tr><tr><td>[Wildcard](#wildcards)</td><td colspan="3">General information about using wildcard DNS records.</td></tr><tr><td>[Unsupported DNS record types](#unsupported)</td><td colspan="3">General information about DNS records not (yet) supported by Openprovider.</td></tr></tbody></table>

## **A Record**

<span class="_Tgc">An A record is used to point a logical domain name, like openprovider.com, to the IP address of Openprovider's hosting server, "76.76.21.21".   
</span>

<span class="_Tgc">The value of this record must be a Valid IPv4 address, see the following example: </span>

![embedded-image-c2cxmodi.png](https://openprovider.help/uploads/images/gallery/2026-08/embedded-image-c2cxmodi.png)

## **AAAA**

<span class="_Tgc">This record has the same function as an A record but while the A record points to a IPv4 address the AAAA record points to a IPv6 address for a given host.</span>

<span class="_Tgc">The value of this record must be valid IPv6 address.</span>

This is what an AAAA record looks like:

![embedded-image-pgdjmdcv.png](https://openprovider.help/uploads/images/gallery/2026-08/embedded-image-pgdjmdcv.png)

## **CAA**

Certification Authority Authorization, or CAA record allows you to declare specific CA's permitted to issue an SSL certificate for your domain.

The record’s syntax is fairly simple. Here's an example of a valid CAA record in Openprovider:

![embedded-image-ah8c5eb9.png](https://openprovider.help/uploads/images/gallery/2026-08/embedded-image-ah8c5eb9.png)

Let's take a look at some of the values more closely:

- **www.domain.tld** - your domain name.
- 0 - Issuer critical value flag. According to RFC 6844, this value should always be set to 0 to be compliant with future extensions to CAA.
- **issue** - Permits a specified CA to issue a certificate for the domain. The value has two valid states: **issue**, which allows non-wildcard certificates to be issued, and **issuewild** - permits the issuance of wildcard certificates.
- **"sectigo.com"** - the domain name of the CA you're granting permission to issue a certificate. You may allow a different CA or multiple CAs to issue certificates in the same way.

Moreover, you can create an additional "**incident reporting**" record, which will send iodef format reports of any issued or requested certificates that violate your CAA policy to a specified email or URL. Please refer to the example below:

![embedded-image-5vfolhbl.png](https://openprovider.help/uploads/images/gallery/2026-08/embedded-image-5vfolhbl.png)

## **CNAME**

<span class="_Tgc">CNAME stands for *Canonical Name* and is an alias for a subdomain. With such a record you can point a subdomain (like www) to the DNS entry of the domain.  
</span>

<span class="_Tgc">The value of such a record must be a valid hostname.</span>

Here is an example of a CNAME record in our system:

![embedded-image-5vgl77wz.png](https://openprovider.help/uploads/images/gallery/2026-08/embedded-image-5vgl77wz.png)

One thing to keep in mind when using CNAME records, a CNAME record gets priority over other records, which means that other records using the same hostname, will not be read. This can cause issues if you have MX or other records using the same hostname as the CNAME record. Learn more [here](https://openprovider.help/books/dns/page/error-cname-cannot-save-zone-record-duplicate-record).

Aliases to the apex are not supported at the moment.

## **MX**

<span class="_Tgc">A *Mail eXchanger* record (**MX record**) is a type of resource record in the Domain Name System that specifies a mail server responsible for accepting email messages on behalf of a recipient's domain, and a preference value used to prioritize mail delivery if multiple mail servers are available.</span>

Here you can see what an MX record looks like:

![embedded-image-di6n6cin.png](https://openprovider.help/uploads/images/gallery/2026-08/embedded-image-di6n6cin.png)

   
Note: MX records with a priority of "NULL" are not supported in our DNS Zones.

## **NS**

<span>Nameserver (NS) records define the authoritative nameservers for the domain. In the Openprovider DNS management, the NS records are created automatically.  
It is not possible to assign nameservers for subdomains.</span>

## **SOA**

This records contains important information about the DNS zone. These records are used to determine how your zone propagates to the secondary nameservers. The SOA record includes the following details:

- The primary name server for the domain.

- The responsible party for the domain.

- A timestamp that changes if you update the domain.

- The number of seconds before the zone should be refreshed.

Hereby you can find an example of a SOA Record:

![embedded-image-uc5kiehu.png](https://openprovider.help/uploads/images/gallery/2026-08/embedded-image-uc5kiehu.png)

<span>In the Openprovider DNS management, the SOA record is created automatically. More information about Openprovider SOA record and its expire value can be found [here](https://openprovider.help/books/dns/page/openprovider-dns-soa-record-and-expire-value).</span>

## **SPF**

Note that the record type "**SPF**" is deprecated; SPF records should be defined in TXT records. More extensive information about SPF records is available on our special [SPF page](https://openprovider.help/books/dns/page/how-do-i-create-an-spf-sender-policy-framework-dns-record).

## **SRV**

SRV records are used in Internet Telephony to define where a SIP service may be found. An SRV record typically defines a symbolic name and the transport protocol used as part of the domain name and defines the priority, weight, port, and target for the service in the record content. It is possible to enter **SRV records** in the DNS panel of Openprovider. The general structure of such a record is the following:

- The **name** of the record is the *service* followed by the *protocol*, for example, **\_sip.\_tls**. No domain name is added: Openprovider does this automatically
- The **value** contains the fields for *weight*, *port,* and *target*, each separated by a space. Example: **1 443 sipdir.domain.com**
- The **priority** is entered into the *priority* field
- The [**TTL**](https://openprovider.help/books/dns/page/what-does-ttl-mean) is entered into the *TTL* field

Some more examples:

<table id="bkmrk-name-type-content-pr"><tbody><tr><td>**Name**

</td><td>**Type**</td><td>**Content**</td><td>**Priority**</td><td>**TTL**</td></tr><tr><td>\_service.\_protocol</td><td>SRV</td><td>weight port target</td><td>priority</td><td>ttl</td></tr><tr><td>\_sip.\_tls</td><td>SRV</td><td>1 443 sipdir.online.lync.com</td><td>100</td><td>86400</td></tr><tr><td>\_sipfederationtls.\_tcp</td><td>SRV</td><td>1 5061 sipfed.online.lync.com</td><td>100</td><td>86400

</td></tr></tbody></table>

## **TXT**

<span class="_Tgc">A TXT record (short for text record) <span class="st">provides text information to sources outside your domain. It</span> is a type of resource record in the Domain Name System (DNS) used to provide the ability to associate some arbitrary and unformatted text with a host or other name, such as human-readable information about a server, network, data center, and other accounting information.</span>

<span class="_Tgc">Hereby an example:</span>

<span class="_Tgc">![embedded-image-awdlqufd.png](https://openprovider.help/uploads/images/gallery/2026-08/embedded-image-awdlqufd.png)</span>

<span class="_Tgc">TXT records are often used in e-mail security, for storing [SPF](https://openprovider.help/books/dns/page/how-do-i-create-an-spf-sender-policy-framework-dns-record), [DKIM](https://openprovider.help/books/dns/page/how-do-i-create-a-dkim-dns-record), and/or [DMARC](https://openprovider.help/books/dns/page/how-do-i-create-a-dmarc-dns-record) DNS records:  
  
Below you find an example of how to create an SPF record in the root zone of a domain.</span>

<span class="_Tgc">![embedded-image-vfgcedgf.png](https://openprovider.help/uploads/images/gallery/2026-08/embedded-image-vfgcedgf.png)  
  
The (SPF) TXT record will look in the DNS zone as:   
![embedded-image-tasootl1.png](https://openprovider.help/uploads/images/gallery/2026-08/embedded-image-tasootl1.png)  
  
</span>It is **required** to surround TXT records with quotes, otherwise, the entire zone can have issues to resolve correctly. It's even required when creating a TXT record to define SPF data; if not surrounded by quotes, the behavior may be different from what you expect.

If you want to add a large TXT record you may use quotes to split it into smaller pieces within one record like the one below:

```
<em>name IN TXT ( “v=DKIM1; g=*; k=rsa; “</em><br></br><em>“p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA1Z4F”</em><br></br><em>“JEMHjJDuBmt25zvYFVejlARZGt1L8f0s1+rLxIPYkfCogQi+Y8”</em><br></br><em>“oLEg9vvEKnLx9aogZzuNt6j4Sty3LgXxaIwHnMqk0LldbA/mh3”</em><br></br><em>“wLZb16Wc6btXHON0o3uDipxqGK2iRLTvcgAnNDegseOS+i0aJE”</em><br></br><em>“nNSl663ywRBp/QKezhUC7cnbqR/H8dz8pEOjeawNN3nexdHGsk”</em><br></br><em>“+RaafYvCFvU+70CQORcsk+mxb74SwGT2CGHWxVywQA9yrV+sYk”</em><br></br><em>“JpxaufZLo6xp0Z7RZmbf1eGlCAdhkEy+KYQpQkw2Cdl7iKIK4+”</em><br></br><em>“17gr+XZOrfFLJ5IwpVK/a19m3BLxADf0Kh3oZwIDAQAB” )</em>
```

## <span class="_Tgc">**Wildcards**</span>

<span class="_Tgc">This section does not describe a special type of record but covers the concept of a wildcard ("\*", a star or asterisk) in a DNS record, like</span>

```
*.example.com    A    1.2.3.4
```

<span class="_Tgc">The above example says that any subdomain under example.com (*www.example.com*, *mail.example.com*, *whatever.example.com*) should be treated as an A record to the IP address 1.2.3.4. This is useful to quickly catch all possible subdomains to one specific IP address.</span>

<span class="_Tgc">There is one important exception when using wildcards: t</span>he wildcard will *not* match if another record exists with the same subdomain. For example, if there is a record *default.**\_domainkey**.example.com*, the wildcard *\*.example.com* will not match ***\_domainkey**.example.com* anymore.

All details about wildcards in a DNS record can be found in section 4.3.3 of [RFC1034](https://tools.ietf.org/html/rfc1034#section-4.3.3).

## <span class="_Tgc">**TLSA records**</span>

<span class="_Tgc">A TLSA record is a DNS record (type TLSA) that binds a TLS certificate or public key to a specific service on a specific host and port, usually protected by DNSSEC. TLSA record is supported by Openprovider DNS service, but **not** by Sectigo Premium DNS.</span>

<span class="_Tgc">To add a TLSA record, you need:</span>

<span class="_Tgc">**Name**: Identifies the service. The format is always `_port._protocol.hostname`</span>

**Type**: TLSA

**Content:** Made up of 4 parts.

- Usage - DANE end-entity
- Selector - Public key (SubjectPublicKeyInfo) of the certificate (DER encoded)
- Matching type - How the TLSA record stores the certificate (eg : SHA-256)
- Certificate association data - Hash of your certificate’s public key

Please refer the screen-shot below for ane example:

![embedded-image-oagfg6ns.png](https://openprovider.help/uploads/images/gallery/2026-08/embedded-image-oagfg6ns.png)

In the above example:

port = 25  
protocol = tcp  
hostname = mail.h\*\*\*\*\*e.nl (domain name is auto filled)  
Type = TLSA  
Usage = 3  
Selector = 1  
Matching type =1   
Certificate association data = e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

\# **Note**: The above are example values. When adding a TLSA record for your domains, please ensure to use real values specific to the host, port and certificate.

## **DNS Round-robin**

By managing the Domain Name System’s (DNS) answers to address requests from client computers according to an acceptable statistical model, round-robin DNS is a technique of load distribution, load balancing, or fault-tolerance delivering multiple, redundant Internet Protocol service hosts, e.g., Web server, FTP servers.

**Drawbacks :**

<div class="c-virtual_list__item" id="bkmrk-although-simple-to-s"><div class="c-message_kit__background p-message_pane_message__message c-message_kit__message"><div class="c-message_kit__hover"><div class="c-message_kit__actions c-message_kit__actions--above"><div class="c-message_kit__gutter"><div class="c-message_kit__gutter__right"><div class="c-message_kit__blocks c-message_kit__blocks--rich_text"><div class="c-message__message_blocks c-message__message_blocks--rich_text"><div class="p-block_kit_renderer"><div class="p-block_kit_renderer__block_wrapper p-block_kit_renderer__block_wrapper--first"><div class="p-rich_text_block">- Although simple to set up, round-robin DNS has several disadvantages, including record caching in the DNS hierarchy and client-side address caching and reuse, which can be difficult to manage when used together.
- For service availability, round-robin DNS should not be depended on entirely.
- If a service at one of the addresses on the list goes down, the DNS will continue to give out that address, and clients will try to contact the broken service.
- <span class="c-message__edited_label">**Openprovider does not actively support DNS Round-robin.**</span>

</div></div></div></div></div></div></div></div></div></div></div>## **Unsupported record types** 

This section contains basic information about record types that are not supported in the Openprovider DNS management. This section is included for reference.

### <span class="_Tgc">**ALIAS/ANAME**</span>

<span class="_Tgc">An ANAME record is like a CNAME record but at the root level. An ANAME record bypasses the problems with CNAME records at the root level, so it can be used to redirect a domain to another domain. However, ANAME records are still in [draft specification](https://tools.ietf.org/html/draft-ietf-dnsop-aname-01) and as a result, are not supported by Openprovider.  
</span>

### <span class="_Tgc">**NAPTR**</span>

<span>NAPTR records are most commonly used for applications in </span>[Internet telephony](https://en.wikipedia.org/wiki/Internet_telephony "Internet telephony")<span>, for example, in the mapping of servers and user addresses in the </span>[Session Initiation Protocol](https://en.wikipedia.org/wiki/Session_Initiation_Protocol "Session Initiation Protocol")<span> (SIP). The combination of NAPTR records with Service Records (SRV) allows the chaining of multiple records to form complex rewrite rules that produce new domain labels or </span>[uniform resource identifiers](https://en.wikipedia.org/wiki/Uniform_resource_identifier "Uniform resource identifier")<span> (URIs). For this moment Openprovider does not support NAPTR records. Because of the different structure of NAPTR records it's **for this moment** not supported by Openprovider.</span>

### **PTR**

<span class="_Tgc">PTR records are used for the Reverse DNS (Domain Name System) lookup. Using the IP address you can get the associated domain/hostname. An **A** **record** should exist for every **PTR record**. The usage of a reverse DNS setup for a mail server is a good solution. A hosting provider can add the record to the IP block.</span>

You can't create a PTR record for the IP address in your domain name DNS zone. The PTR record needs to be created in the rDNS zone by the owner of the netblock that encompasses your IP address (i.e. your ISP).  
  
So, this **cannot** be added to your DNS zone at Openprovider.

### **Use of '@' symbol**

Some DNS providers allow the use of the `@` symbol to represent the root domain (e.g., example.com).

However, our system does not support this notation. Instead, please leave the "Name" field blank when editing a DNS zone.